GHSA-ccmr-qj26-845g
Improper Restriction of XML External Entity Reference in Elasticsearch
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | >= 6.5.0, < 6.5.2 | 6.5.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.
References
External links from the advisory. They lead to third-party sites.